This is the implementation-grade specification for the Go/Badger/x402/OCI/Kubernetes/Knative product, its IPFS evidence layer, its node identity and wallet custody, its required Base USDC dependency, and its optional evidence-anchor contract.
Current formal gate: M0 — BLOCKED
Target objectives: M3 — complete eight-action lifecycle; M7 — operational one-node IPFS evidence layer
The immediate product target remains the complete eight-action lifecycle. The deterministic evidence-block and IPFS publication subsystem is now an explicit one-node delivery milestone before release rehearsal; it is not deferred behind G-SINGLE and is not consensus.
Procedure: git rev-parse HEAD; git rev-parse HEAD^{tree}; git status --short
Do not mix dirty-workspace observations into evidence for the pinned commit.
Procedure: make test in mutable canonical workspace
This records in-progress workspace health only. It neither changes nor proves the pinned commit; it must be superseded by a test artifact generated from the accepted immutable baseline.
Procedure: make e2e-hermetic
Fixture-based and no-spend; it does not prove the planned real all-eight customer lifecycle.
Procedure: make generate-check
Generated parity only.
gateway + executor + embedded registry
Badger + OCI files on one RWO PVC
operator-controlled, invite/allowlist workload class
deterministic Merkle evidence blocks + redundant retrieval + standalone verification
EIP-191 actions, EIP-3009 payments, exact payer/payee/contract verification.
Stable identity manifest, evidence signer, Safe payee/treasury and admin, refund and rotation controls.
Immutable append-only root/CID registry behind G-COMMIT-BASE.
Open the normative wallet and contract specification →
The production target is not “a process and a database.” It is the integrated Go, Badger, EIP-191, x402, Base/USDC, OCI, Kubernetes, Knative, Helm, supply-chain, deterministic evidence-block, and IPFS publication system below—operated as one operator-controlled node with separated signer and custody roles.
Externally held EIP-191 action signer and EIP-3009 payer. Current code does not support ERC-1271 contract wallets.
Exact chain, address, EIP-712/EIP-3009 domain, authorization/event/receipt and code/proxy identity must be pinned.
Separate 2-of-3 treasury/payee and node/contract-admin authority; neither private key enters cynderd.
Low-balance signer submits exact immutable evidence commitments to CynderEvidenceAnchorV1 after G-COMMIT-BASE.
Normative role, custody, ABI, lifecycle, and failure specification →
Versioned canonical encoding, domain-separated hashing, deterministic package bytes, CID derivation and pin/readback.
Badger cutoff → sealed envelope/CAR → expected CID → publish/pin → independent retrieval and verification.
Badger owns sequence, cutoff, sealed bytes, expected CID, attempts, availability observations and quarantine state.
The repository has no evidence-block builder, Merkle pipeline, IPFS client/publisher, redundant pinning or standalone verifier yet.
| Layer | Implemented technology |
|---|---|
| Language / process | Go 1.25; net/http; JSON slog; graceful SIGINT/SIGTERM shutdown |
| Canonical state | BadgerDB v4.8 with synchronous writes and persisted node identity |
| API / projection | HTTP/JSON REST; OpenAPI 3.1; embedded public explorer; Server-Sent Events |
| Wallet authority | CAIP-10 eip155:8453 identities; EIP-191 personal-sign domain binding |
| Payment | x402 v2 exact EVM; EIP-3009 TransferWithAuthorization; Base mainnet; native USDC |
| Ethereum integration | go-ethereum client, signature recovery, JSON-RPC receipt/event reconciliation |
| Artifact custody | Docker Distribution v3; OCI/Docker Distribution API v2; filesystem blobs |
| Workload control | Kubernetes client-go; Knative Serving client; deterministic Service/revision identities |
| Packaging | multi-stage BuildKit; CGO_ENABLED=0; distroless Debian 12; non-root runtime |
| Deployment | Helm v3; Kubernetes ≥1.28; one Deployment/Service/PVC; ConfigMap; Secret refs; RBAC; NetworkPolicy; optional Ingress |
| Serverless runtime | Knative Serving 1.23 and Kourier 1.23 checksum-pinned installation assets |
| Release / recovery | GHCR digest pinning; GitHub Actions protected environment; keyless Cosign; Helm atomic rollout; VolumeSnapshot |
Strict action preparation/execution, authenticated owner reads, sanitized public explorer, search/detail projections, SSE stream, /docs, /openapi.json, liveness and readiness all share the one listener.
Canonical Base wallet identity and owner→tenant mapping. Enrollment is durable and scoped: PENDING_REVIEW → APPROVED_INACTIVE → ACTIVE. Review and activation are separate operator authorities; enrollment never auto-activates x402 access.
Durable two-phase lifecycle with bounded in-process serialization, payment gating, persisted dispatch fences, action-specific projection commits and digest-linked receipts. Ambiguous post-dispatch effects become UNKNOWN; ambiguous INVOKE is not automatically retried.
x402 v2 exact-EVM on Base mainnet binds signer, payer, payee, native USDC asset, amount and immutable action. Facilitator response is not finality: Base authorization state, events, transfer and transaction receipt are reconciled independently.
Distribution v3 serves /v2/. Basic credentials exchange for HMAC-SHA256 short-lived tenant/repository/action-scoped bearer tokens. Deterministic rotatable pull credentials feed immutable Kubernetes image-pull secrets. Admission hashes manifests/blobs and requires Linux/amd64.
Deterministic Knative Services and revisions run cluster-local in a distinct workload namespace. Cynder creates service accounts, immutable pull secrets, quotas and NetworkPolicies; reconciles readiness; proxies invocation; activates versions; rolls back; and confirms deletion.
One synchronous-write database owns immutable actions, mutable lifecycle state, payment fingerprints/bindings, sequenced receipt chains, deployment/version state, wallet enrollments, artifacts, retention/pins, registry accounting, recovery schedules and node identity.
Digest-pinned GHCR control image, protected GitHub deployment environment, keyless Cosign verification, Helm --atomic --wait, post-deploy checks, image-only rollback and quiesced CSI VolumeSnapshot tooling. Replacement-PVC restore and recurring recovery drills remain unproved.
ConfigMap carries non-secret runtime policy. Existing Kubernetes Secret references supply Base RPC and registry credential material. The pod uses a projected expiring service-account token; the roadmap names secret references only, never values.
JSON logs, health/readiness, public projections and release verification exist. Production still requires correlation-complete metrics/traces, ambiguity and reconciliation alerts, SLOs, capacity alarms, incident freeze controls and recurring operational evidence.
| Boundary | Protocol and binding |
|---|---|
| Action API | HTTPS + JSON; Idempotency-Key; CYNDER-ACTION-DIGEST; CYNDER-ACTION-SIGNATURE |
| Wallet identity | CAIP-10 eip155:8453:0x… plus EIP-191 personal-sign authority |
| Payment challenge | x402 v2 PAYMENT-REQUIRED / PAYMENT-SIGNATURE / PAYMENT-RESPONSE |
| USDC transfer | EIP-712 typed data + EIP-3009 TransferWithAuthorization |
| Settlement truth | Base HTTPS JSON-RPC; nonce, AuthorizationUsed event, transaction receipt and exact Transfer reconciliation |
| Artifact API | OCI / Docker Distribution v2 at /v2/; Basic exchange → short-lived scoped bearer token |
| Runtime control | Kubernetes REST + Knative Serving API; SelfSubjectAccessReview before readiness |
| Invocation | Cluster-local HTTP POST; X-Cynder-Invocation-ID + Idempotency-Key |
| Operations | /healthz, /readyz, /registry/readyz; explorer SSE at /v1/explorer/stream |
The authoritative state must be derivable from explicit durable records and transitions—not process memory, UI state or whatever Kubernetes happens to report.
| State class | Contents and authority |
|---|---|
| Canonical Badger records | actions; action-state; action identity; payments; payment fingerprints; action-payment bindings; receipts; invocation replay; deployments; versions; activations; delete claims/tombstones; wallet enrollment; artifacts; pins; registry accounting; node and index metadata |
| Canonical OCI bytes | manifests, configs and layers under /var/lib/cynder/registry; content addressed but not stored as Badger values |
| Derived / rebuildable | explorer/search indexes and aggregate projections; never the authority for action/payment/runtime truth |
| External observations | Kubernetes and Knative object/status observations; reconciled effects, not canonical Cynder state |
| Ephemeral only | process locks, HTTP request state, caches and transient worker state; never sufficient to prove a durable transition |
| Backup unit | the quiesced shared PVC containing /badger and /registry, bound to the persisted node/PVC identity |
PREPARE: strict payload → owner/scope admission → immutable canonical action → PENDING / UNPAID → ACCEPTED receipt AUTHORIZE: EIP-191 route+origin+digest authority → owner recheck PAY: x402/EIP-3009 proof → durable reservation → facilitator verify/settle → Base reconciliation → SETTLED receipt EXECUTE: claim → EXECUTING receipt → durable DISPATCHED fence → runtime/registry/wallet effect FINALIZE: projection commit → SUCCEEDED or FAILED → digest-linked terminal receipt AMBIGUOUS: post-dispatch uncertainty → UNKNOWN → bounded reconciliation; never blind INVOKE replay
ENROLL_WALLET → PENDING_REVIEW → independent review → APPROVED_INACTIVE → independent activation → ACTIVE → REGISTER_ARTIFACT → DEPLOY → INVOKE v1 → DEPLOY_VERSION → INVOKE v2 → ROLLBACK_VERSION → INVOKE rolled-back v1 → RETAIN_ARTIFACT → DELETE → Knative runtime absent + durable deployment tombstone + preserved action/payment/receipt/version/artifact history
| Action | Technology path | Durable result |
|---|---|---|
| ENROLL_WALLET | HTTP/JSON → CAIP-10 owner → scoped enrollment store | PENDING_REVIEW; no automatic paid access |
| REGISTER_ARTIFACT | OCI v2 → tenant bearer auth → manifest/blob hash and limits | APPROVED immutable artifact record; signature/vulnerability NOT_CHECKED today |
| RETAIN_ARTIFACT | owned repository@digest → retention validator | absolute retention deadline; replay cannot extend twice |
| DEPLOY | settled x402 → ActionEngine → registry proof → Knative Service | deployment + initial immutable version + readiness + artifact pin |
| DEPLOY_VERSION | signed source tag resolves to signed digest → Knative revision | new immutable version; active pointer moves only after readiness |
| ROLLBACK_VERSION | stored version identity → exact Knative image/revision reconcile | rollback activation; prior history remains append-only |
| INVOKE | cluster-local HTTP + invocation/action idempotency headers | bounded persisted output/receipt, or UNKNOWN if response is ambiguous |
| DELETE | delete claim → UID/label-owned Knative removal → pin release | runtime absence + atomic durable tombstone and terminal receipt |
Current admitted posture: controlled, reviewed workloads. Shared-kernel execution is not proof of a hardened hostile multi-tenant sandbox.
Kubernetes ≥1.28, Knative Serving 1.23, Kourier 1.23, CSI snapshot support; ingress-nginx and cert-manager when publicly exposed.
HTTPS x402 facilitator, trusted Base mainnet RPC, native Circle USDC and operator-controlled payTo/custody. Each can fail independently of action execution.
GHCR candidate image, protected GitHub environment, keyless Cosign identity, exact chart/config/environment. Mutable tags are never execution or release authority.
Implementation-grade gates now bind wallet roles, contract identities, custody, rotation, failure semantics, evidence, and release identity—not merely code presence.
Freeze the exact source, release, environment, state authorities, and evidence schema used by every later claim.
depends: noneStop: Stop if source/OpenAPI disagree, release identity is incomplete, or payment/effect/receipt states collapse into one success field.
Make the existing one-node state machines and idempotency guarantees explicit and machine-testable.
depends: M0Stop: Stop if any consequential transition depends only on process memory or HTTP response delivery.
Make Badger plus the registry volume a clean, recoverable authority rather than an accidental collection of local records.
depends: M1Stop: Stop on partial migration without a deterministic resume/restore path, broken receipt chain, or irreconcilable canonical reference.
Prove the product as one coherent customer journey through the public/control boundary, not eight isolated handlers.
depends: M2Stop: Stop if an action works only in isolation, ownership/scope is bypassable, or active version, digest, runtime revision, and receipt disagree.
Define and prove the recovery rule at every money/effect ambiguity boundary without claiming exactly once.
depends: M3Stop: Stop on duplicate consequential effect, invisible recovery backlog, unsafe automatic retry, or evidence-destructive manual status edit.
Make real payment safe enough for bounded spend and daily reconciliation.
depends: M3Stop: Stop on wrong binding, unexplained variance, duplicate transfer/refund, reorg-invalid evidence, custody uncertainty, or spend-cap breach.
Prove the admitted workload class matches the isolation the one-node platform actually provides.
depends: M3Stop: Stop on secret leakage, cross-tenant access, mutable artifact execution, unrestricted egress, privilege escape, or isolation weaker than admitted workload.
Make externally retrievable, independently verifiable evidence a built-in property of one-node Cynder before release rehearsal, without making IPFS canonical or putting it in the execution-critical path.
depends: M1, M2, M3, M4Stop: Stop the publication lane on nondeterministic bytes/root/CID, privacy leakage, conflicting node/sequence commitment, missing eligible-record coverage, unavailable alternate evidence, unbounded backlog, or production-path impact. Preserve canonical Badger history and quarantine conflicting evidence; do not stop customer execution solely because IPFS is unavailable.
Operate one node, including its asynchronous evidence publisher, without reading raw Badger and recover it without losing canonical or sealed evidence.
depends: M4, M5, M6, M7Stop: Stop on monitoring blindness, failed restore, stale backup beyond RPO, broken alert delivery, or telemetry leakage.
Produce one exact release that can be approved as tested or rejected without ambiguity.
depends: M8Stop: Stop when running bytes/config differ from reviewed evidence, rollback/restore cannot execute, or any critical blocker remains.
Collect real technical, operational, customer, and economic evidence from one bounded paid workload.
depends: M9, G-PRODStop: Contain on any global stop condition; close pilot at its explicit end even if healthy.
C14 and C15 make node identity/wallet custody and Base contract integration first-class technical ownership lanes.
Current baseline: Implemented; production contract proof incomplete
Required delta: Pin canonical schemas, encodings, state machines, errors, generated parity, and conformance.
Surfaces: internal/model/action.gointernal/httpapi/actions.goapi/openapi.yaml
Current baseline: Durable enrollment + dual control exist; general operator surface/runbook incomplete
Required delta: Prove signer domain, owner/scope checks, review/activation separation, revoke/rotation, and lifecycle composition. Keep node roles unreachable from customer enrollment and label ERC-1271 unsupported until implemented.
Surfaces: internal/auth/auth.gointernal/payment/action_x402.gointernal/store/wallet_enrollment.go
Current baseline: Substantial implementation; needs explicit contract/integrity/operator resolution
Required delta: Assign every transition, fence effects, preserve UNKNOWN, validate receipt chains, and expose safe operator decisions.
Surfaces: internal/platform/action_engine.gointernal/store/action_store.gointernal/model/action.go
Current baseline: Verification/settlement/reconciliation foundations exist; production finality/refund/accounting policy incomplete
Required delta: Prove exact binding, finality/reorg behavior, liabilities, refunds, daily reconciliation, custody, and spend caps. Pin and verify exact USDC contract/proxy identity and original-payee rotation semantics.
Surfaces: internal/payment/action_x402.gointernal/payment/action_x402_reconcile.go
Current baseline: Registry, registration, retention metadata, limits, and pins exist; signature/vulnerability enforcement and GC missing
Required delta: Enforce provenance, safe retention/GC, accounting integrity, tenant auth, interruption recovery, and active-pin protection.
Surfaces: internal/registry/registry.gointernal/store/artifact_store.go
Current baseline: Implemented with immutable versions/tombstones; requires real-cluster and fault proof
Required delta: Prove stable runtime identity, readiness-gated activation, convergence after crash, exact rollback, and tombstoned delete.
Surfaces: internal/gateway/action_executor.gointernal/runtime/knative.gointernal/store/deployment_versions.go
Current baseline: Persisted replay and UNKNOWN behavior exist; customer-side effect contract/operator resolution incomplete
Required delta: Prove no automatic reinvoke after ambiguity, persisted output replay, response limits/privacy, and action-ID propagation.
Surfaces: internal/gateway/action_executor.gointernal/platform/action_engine.go
Current baseline: Sanitized explorer/SSE/stats exist; operator observability is insufficient
Required delta: Keep public data minimal while adding authorized operational views for ambiguity, recovery, reconciliation, and evidence.
Surfaces: internal/httpapi/explorer_stream.gointernal/store/explorer_search.gointernal/store/explorer_stats.go
Current baseline: Single-replica packaging and safety checks exist; target-environment proof required
Required delta: Prove exact immutable release, TLS/origin, CNI policy, least privilege, resource bounds, upgrade, and rollback.
Surfaces: charts/cynderhack/deploy.shhack/verify-deployment.sh
Current baseline: Snapshot helper and hermetic restore tests exist; real replacement-PVC restore and migration framework incomplete
Required delta: Prove schema compatibility, quiesced snapshots, isolated restore, integrity checks, RPO/RTO, rollback/restore decision, and drills.
Surfaces: hack/backup-volume-snapshot.shhack/rollback.shinternal/registry/backup_restore_acceptance_test.go
Current baseline: Health/readiness and JSON logs exist; metrics/traces/alerts/SLO evidence largely missing
Required delta: Instrument every boundary, redact secrets, adopt thresholds, alert on ambiguity/capacity/outages, and measure pilot SLOs.
Surfaces: cmd/cynderd/main.gointernal/httpapi/actions.go
Current baseline: Partial lifecycle tests exist; full eight-action real/product/economic proof missing
Required delta: Compose all eight actions, bind evidence to release/environment, and measure every action cost, liability, support burden, and customer outcome.
Surfaces: internal/httpapi/lifecycle_e2e_test.gohack/e2e.sh.github/workflows/deploy.yml
Current baseline: Not implemented; required one-node delivery scope
Required delta: Specify canonical public evidence bytes, seal linked Merkle blocks, persist publication state, publish/pin exact IPFS content, independently retrieve and verify it, prove privacy and completeness boundaries, and keep failures asynchronous to customer execution.
Surfaces: internal/evidence (new)internal/store/evidence_blocks.go (new)internal/ipfs (new)cmd/cynder-verify-evidence (new)charts/cynder
Current baseline: Stable node label and configured payTo exist; formal cryptographic binding/custody does not
Required delta: Implement the signed manifest chain, separated evidence/anchor/payee/admin/pauser/refund roles, startup binding, rotation/revocation, anti-fork restore, and public non-secret status.
Surfaces: internal/store/action_store.gointernal/identity (new)internal/signing (new)charts/cynderoperator custody manifests/runbooks
Current baseline: Native Base USDC integration exists; no Cynder contract
Required delta: Pin external USDC identity; specify/test/deploy the optional immutable append-only anchor contract, bounded submitter, event/head indexer, signer rotation, pause, finality/reorg handling, and independent verification.
Surfaces: internal/paymentcontracts/CynderEvidenceAnchorV1.sol (new optional)internal/anchor (new optional)cmd/cynder-verify-evidencedeployment manifest
Wallet roles, contract identity, signer custody, rotation, chain truth, and refund/anchor ambiguity now have named evidence contracts and containment rules.
| ID | Claim | Procedure | Expected | Gate | Freshness |
|---|---|---|---|---|---|
| EV-BASE-01 | Source/OpenAPI parity | make generate-check | No diff or stale generated artifact | M0/C01 | every candidate |
| EV-UNIT-01 | Go package behavior | make test | All packages pass on pinned source | M0–M9 | every candidate |
| EV-ACC-01 | Contract and acceptance suite | make acceptance | All acceptance assertions pass | M1–M9 | every candidate |
| EV-HELM-01 | Rendered chart safety | make helm-lint | Chart renders and policy checks pass for exact values | M6/M9 | every chart/config change |
| EV-LIFE-01 | All-eight hermetic lifecycle | make e2e-hermetic | Complete journey and per-step readback pass from empty state | M3 | every candidate |
| EV-LIFE-02 | Target-cluster lifecycle | guarded cluster procedure | Real Knative/registry lifecycle passes against named environment | M3/M9 | every candidate/environment |
| EV-FAIL-01 | Crash and ambiguity matrix | fault-injection suite | No duplicate effects; expected UNKNOWN/reconciliation states persist | M4 | every effect/payment change |
| EV-PAY-01 | Bounded real USDC trace | guarded real-spend procedure | Exact Base evidence reconciles to action, receipt, and ledger under cap | M5/M9 | before pilot and each payment change |
| EV-SEC-01 | Runtime and tenant security | target-cluster security suite | Isolation, CNI policy, RBAC, secrets, provenance, and resource bounds pass | M6/M9 | every runtime/policy change |
| EV-RESTORE-01 | Real isolated restore | VolumeSnapshot restore drill | Replacement PVC restores complete canonical state within adopted RPO/RTO | M8/M9 | before pilot; recurring during operation |
| EV-OPS-01 | Alerts and outage behavior | injected dependency/outage drill | Expected alert, containment, recovery, and evidence are recorded | M8/M9 | before pilot and each alert/runbook change |
| EV-REL-01 | Exact release rehearsal | release rehearsal packet | Install/upgrade/fail/rollback/restore/rotate/freeze pass on exact digests | M9/G-PROD | each candidate |
| EV-PILOT-01 | Paid operated-product proof | bounded pilot evidence packet | SLO, traces, reconciliation, cost, support, repeat use, and incidents reviewed | M10/G-SINGLE | pilot close |
| EV-COMMIT-01 | Deterministic block, Merkle, and CID vectors | cross-run golden vector suite | Identical eligible records produce identical ordered leaves, root, envelope bytes, and expected CID; mutation, omission, duplication, and reordering are detected | M1/M2/M7 | every evidence-format change |
| EV-COMMIT-02 | IPFS round trip and availability | publish exact canary bytes; retrieve through independent endpoint/pin | Retrieved bytes match expected CID and reproduce the Merkle root through at least two availability paths | M7/G-IPFS | every release and recurring operation |
| EV-COMMIT-03 | Optional Base anchor and reorg verification | separately authorized bounded anchor canary | Exact node/sequence/root/CID commitment reaches adopted finality; reorg cannot rewrite canonical or sealed history | G-COMMIT-BASE | before activation and each anchor change |
| EV-COMMIT-04 | Crash and ambiguity recovery | fault injection at cutoff, serialize, seal, publish, CID-persist, and readback boundaries | Recovery resumes identical bytes and one logical node/sequence without omission, duplicate publication identity, or conflicting root | M7 | every publication-state change |
| EV-COMMIT-05 | Independent evidence verification | standalone verifier starts from CID and retrieved bytes without cynderd access | Verifier validates schema/linkage, reconstructs leaves/proofs, and reproduces the expected root while exposing coverage boundaries | M7/M9/M10 | every release and pilot window |
| EV-COMMIT-PRIVACY | Public evidence privacy boundary | forbidden-field fixture corpus plus serialized-object scan | No secrets, authorizations, private inputs/outputs, credentials, or prohibited customer metadata enter IPFS objects | M7/G-IPFS | every projection/schema change |
| EV-WALLET-01 | Customer signer contract and replay domain | cross-language EIP-191 vectors plus EOA/contract-wallet negative fixtures | Only the exact supported EOA, origin, method, route, action, idempotency key, and digest verify; ERC-1271 fails explicitly | M1/G-WALLET-CONTRACT | every signing-contract change |
| EV-WALLET-02 | Node role and custody separation | manifest/runtime/custody inventory plus key/account collision tests | Evidence, anchor, payee/treasury, admin, pauser, refund, and customer roles are independently bound; no treasury/admin key is in cynderd | M5/G-WALLET-CONTRACT | every role/config/release change |
| EV-WALLET-03 | Rotation, revocation, compromise, and restore | planned and emergency evidence/anchor/payee/admin rotation drills plus stale-snapshot recovery | History remains verifiable; new authority starts at explicit boundary; old restore cannot fork node/sequence | M5/M8/G-WALLET-CONTRACT | before production and every custody change |
| EV-USDC-CONTRACT-01 | Pinned Base USDC identity | chain/address/ABI/EIP-712 domain/proxy implementation/runtime-code and event verification | Configured native Base USDC is exact and drift is detected before paid readiness | M5/G-WALLET-CONTRACT | startup, release, and dependency change |
| EV-USDC-CONTRACT-02 | EIP-3009 settlement truth | forked-chain unused/settled/duplicate/expired/malformed/reorg fixtures | Facilitator response cannot override canonical authorization, Transfer, receipt, block, payer, payee, amount, and action evidence | M5/G-WALLET-CONTRACT | every payment/reconciliation change |
| EV-ANCHOR-CONTRACT-01 | Anchor ABI/state/event/access invariants | Solidity unit/fuzz/invariant tests plus Go/Solidity anchor-ID vectors | Unauthorized, replayed, skipped, stale-predecessor, duplicate, and conflicting anchors fail; pause/rotation preserve head | G-COMMIT-BASE | every contract change |
| EV-ANCHOR-CONTRACT-02 | Immutable deployment identity | verified source/bytecode/compiler/constructor/ABI/runtime-code/deployment transaction readback | Signed deployment manifest reproduces exact immutable Base deployment identity | G-COMMIT-BASE | every deployment |
| EV-ANCHOR-TX-01 | Bounded anchor transaction lifecycle | Sepolia canary with signer policy, nonce/replacement, fee caps, receipt loss, reorg, RPC outage, and backlog recovery | One immutable intent per sequence reaches configured finality or halts without root/sequence mutation; IPFS/customer execution continues | G-COMMIT-BASE | before mainnet and every submitter/finality change |
| EV-TREASURY-01 | Payment and refund reconciliation | payer→original-payee→treasury/refund chain and ledger reconciliation | Zero unexplained variance; refunds return only to original payer under dual approval and stable intent identity | M5/G-WALLET-CONTRACT/M10 | daily and every refund |
| Scenario | Required durable state | Recovery rule |
|---|---|---|
| Payment settled; execution fails | Payment remains settled; effect is FAILED only when authoritative; refund is a separate decision | reconcile exact chain/action evidence; never resettle |
| Payment settlement outcome unknown | Block execution unless authoritative policy/evidence permits it; reserve liability | reconcile the same authorization/transaction; no replacement payment |
| Effect succeeds; HTTP response lost | Return persisted action/output/receipt on replay | no second dispatch or charge |
| Effect may succeed; state/receipt write fails | Persist UNKNOWN or recover through effect-specific status probe | INVOKE is not automatically repeated |
| Crash before dispatch | Safe bounded retry after durable claim/recovery inspection | same action, payment binding, and attempt history |
| Crash during deploy/version/rollback/delete | Probe stable runtime identity and converge under fence | record every recovery attempt |
| Knative timeout or dependency outage | Classify pre-effect versus ambiguous post-dispatch | alert, contain, and respect retry class |
| Duplicate request/payment/callback | Return/reconcile the existing canonical operation | reject conflicting body or cross-action fingerprint |
| Backup/restore mismatch | Readiness false; mutation disabled | preserve original and investigate; no silent repair |
| Receipt-chain or node-ID mismatch | Readiness false; paid actions blocked | restore or repair through evidence-preserving procedure |
| IPFS publication unavailable or ambiguous | Canonical operation continues; sealed bytes, expected CID, cursor, attempt, and retry state remain durable | read back expected CID, then retry the exact same bytes; never reseal a different block for the same node/sequence |
| Conflicting evidence root or CID for one node/sequence | Commitment lane QUARANTINED; both trails preserved; canonical receipts unchanged | stop evidence publication, investigate source/cutoff/encoding, and re-enter only through reviewed evidence-preserving repair |
| IPFS object unavailable after publication | Evidence availability alert and degraded evidence status; customer execution remains available | restore/re-pin identical CAR/envelope from durable bytes or verified mirror and revalidate the same CID |
| Wrong or shared node-wallet role | Mutation readiness false; active manifest and runtime mismatch preserved | correct role binding or apply threshold-authorized manifest; never repurpose a customer/treasury/admin key |
| Contract wallet used where EOA-only recovery is supported | Action/payment rejected before settlement or effect | use supported EOA or separately implement ERC-1271; never pretend EOA recovery verifies a contract wallet |
| Payee rotates with outstanding challenges | New quotes use new payee; old authorization remains bound to original payee | reconcile within bounded overlap; never redirect or rewrite signed authorization |
| Evidence/anchor signer unavailable or compromised | Affected signing lane stopped; last trusted sequence, attempts, and public key interval retained | offline-authorized rotation/revocation; dispute affected interval append-only; never erase or silently re-sign |
| USDC or anchor contract identity drifts | Paid/anchor readiness false; customer reads and canonical Badger preserved | verify exact chain/proxy/runtime code/ABI/deployment and authorize a new pinned manifest if intentional |
| Anchor transaction dropped, replaced, reorged, or conflicting | All attempts retained; one immutable AnchorInput; no next sequence on conflict | reconcile receipt, canonical block, event and head; rebroadcast identical payload only if canonical acceptance absent |
| Treasury/refund authority unavailable or refund ambiguous | Liability reserved; stable refund intent and chain attempts retained | Safe-authorized exact-payer refund or reconciliation; never create a second intent blindly |
The initial one-node product includes deterministic evidence blocks, IPFS publication, redundant availability, and independent verification. This work is now M7 on the active delivery path before operations and release rehearsal.
schema_version, node_id, block_sequenceprevious_block_commitmentleaf_countmerkle_algorithm_version and merkle_rootcreated_at metadata, never ordering authorityDRAFT → SEALED → PUBLISHED
│ │
├─ PUBLISH_RETRYABLE
└─ QUARANTINED on nondeterminism, privacy leak, or conflict| Invariant | Required behavior |
|---|---|
| Seal once | One node/sequence has one cutoff, one immutable byte representation, one Merkle root, and one expected CID. |
| Retry exact bytes | Ambiguous publication triggers expected-CID readback and retry of the identical CAR/envelope. |
| Persist before network | Cutoff, sealed bytes, expected CID, attempts, availability observations, and quarantine state survive restart in Badger. |
| Remain asynchronous | IPFS failure degrades evidence freshness but does not stop admission, payment, execution, receipts, or recovery. |
| Prove availability | At least two independently controlled retrieval paths reproduce the expected CID and Merkle root. |
| Quarantine conflicts | Conflicting roots/CIDs preserve both trails, stop publication, and never rewrite canonical receipts. |
Canonical projection, cutoff, Merkle blocks, durable publisher, IPFS package/pinning, independent readback, standalone verifier, privacy tests, and outage recovery.
Deterministic vectors, crash recovery, independent retrieval, redundant availability, privacy proof, bounded lag, and zero impact on customer execution.
Separately authorize the exact immutable non-proxy contract, node-scoped anchor signer, admin Safe, pauser, runtime code/ABI, spend cap, sequence/head invariants, finality and reorg controls.
Independent runs over identical eligible records produce byte-identical leaves, tree, root, envelope, and expected CID.
Publish exact bytes and independently retrieve them through at least two controlled availability paths.
Crash at every local/network boundary and resume the same logical block and exact bytes.
A standalone verifier needs no cynderd API and reports root validity, record inclusion, sequence linkage, and coverage boundaries.
Forbidden-field fixtures prove private or secret material never enters public IPFS objects.
AnchorInput: nodeId, identityEpoch, blockSequence, previousAnchor, identityManifestDigest, evidenceEnvelopeDigest, merkleRoot, contentCommitment, schemaVersion.
Contract: append-only per-node head, exact next sequence/predecessor, signer role, duplicate/conflict rejection, delayed signer rotation, pause-only emergency control, immutable deployment identity, events sufficient for independent reconstruction.
Read the complete normative ABI, custody, and transaction lifecycle →
G-WALLET-CONTRACT makes custody and external-contract truth mandatory before production. G-COMMIT-BASE remains a separate optional activation decision.
Requires: M0, EV-BASE-01, EV-UNIT-01
Accept source/state authority or return for correction.
Requires: M1–M3, EV-ACC-01, EV-LIFE-01, EV-LIFE-02
Advance to parallel hardening or return to the broken component.
Requires: M1, M5, EV-WALLET-01, EV-WALLET-02, EV-WALLET-03, EV-USDC-CONTRACT-01, EV-USDC-CONTRACT-02, EV-TREASURY-01, signed wallet/contract release manifest
Permit production hardening only when customer-wallet support, node-role separation, payee/treasury/refund custody, node identity binding, and external Base USDC identity are explicit and verified. This does not activate the optional anchor contract.
Requires: M4–M8, EV-FAIL-01, EV-PAY-01, EV-SEC-01, EV-COMMIT-01, EV-COMMIT-02, EV-COMMIT-04, EV-COMMIT-05, EV-COMMIT-PRIVACY, EV-RESTORE-01, EV-OPS-01, G-WALLET-CONTRACT
Permit exact-release rehearsal only after the one-node IPFS evidence layer is independently retrievable and recoverable.
Requires: M7, EV-COMMIT-01, EV-COMMIT-02, EV-COMMIT-04, EV-COMMIT-05, EV-COMMIT-PRIVACY
Accept the asynchronous evidence-publication layer as part of the one-node product or return to its originating contract/runtime defect. This does not activate Base anchoring or consensus.
Requires: M9, G-IPFS, EV-REL-01, named customer/workload/release/environment/caps/authority, G-WALLET-CONTRACT
Named human approves or declines one bounded paid pilot. Technical passage alone does not activate it.
Requires: M10, EV-PILOT-01, published evidence coverage for the pilot window, current recovery/security/accounting evidence
Operate, improve, bounded one-node expansion, or stop. Decentralization is not an automatic output.
Requires: G-IPFS, EV-COMMIT-03, EV-ANCHOR-CONTRACT-01, EV-ANCHOR-CONTRACT-02, EV-ANCHOR-TX-01, signed deployment manifest, Base Sepolia proof, exact admin/pauser/anchor-signer custody, mainnet fee/finality/reorg/disable controls, separate human activation
Authorize or decline the exact immutable CynderEvidenceAnchorV1 deployment and bounded Base mainnet submitter. This remains optional and cannot block M7, G-IPFS, customer execution, or G-SINGLE.
Name customer, supported wallet type, active node-manifest digest/epoch, public role key IDs, payee/treasury Safe, refund/admin/pauser identities, exact Base USDC address and code/proxy identity, release/environment, IPFS endpoints, caps, SLO/RPO/RTO, evidence lag, and—only when enabled—anchor contract/code/ABI/signer/finality/spend policy.
| Metric | Requirement | Gate |
|---|---|---|
| Release identity | Exact source, image, chart, config, node, environment, Kubernetes/Knative, Base/USDC, facilitator, RPC | M0/M8 |
| Customer/workload bound | One named customer; one reviewed digest-pinned workload; exact scopes | G-PROD |
| Duplicate consequential effects | 0 | M4–M10 |
| Unexplained reconciliation variance | 0 | M5–M10 |
| Critical unresolved custody/security findings | 0 | M6–M10 |
| RPO / RTO | TO ADOPT before G-PROD; provisional target ≤24h / ≤60m | M8 |
| Control-plane availability | TO ADOPT before G-PROD; provisional pilot target 99% excluding approved maintenance | M8/M10 |
| Critical alert delivery/acknowledgment | TO ADOPT before G-PROD; provisional pilot target 100% | M8/M10 |
| Spend/rate/concurrency/storage caps | Exact values required in activation packet | G-PROD |
| Observation window | Exact start/end and minimum operation count required in activation packet | G-PROD/M10 |
| Evidence publication lag | TO ADOPT before G-IPFS; observable backlog with bounded age and no silent gaps | M7/G-IPFS |
| IPFS evidence availability | Expected CID retrievable through at least two independently controlled availability paths | M7/G-IPFS/M10 |
| Evidence privacy violations | 0 | M7–M10 |
| Conflicting root/CID for one node sequence | 0; any conflict quarantines publication | M7–M10 |
| Wallet role collisions | 0 | M5/G-WALLET-CONTRACT |
| Runtime/manifest payee or signer mismatch | 0; affected paid/signing readiness false | M5–M10 |
| USDC/anchor contract code drift | 0 unresolved | G-WALLET-CONTRACT/G-COMMIT-BASE |
| Unauthorized node/contract transaction | 0 | M5–M10 |
| Anchor transactions in flight | maximum 1 per node | G-COMMIT-BASE |
| Anchor signer balance | between adopted minimum gas reserve and maximum blast-radius cap; 0 USDC | G-COMMIT-BASE |
| Treasury/refund unexplained variance | 0 | M5/M10 |
| Key rotation age | adopted per-role maximum; no expired active signer | M5–M10 |
Re-enter only after: immutable evidence preserved; exact role/chain/contract/signing defect corrected; rotation/recovery or reconciliation completed; regression evidence refreshed; independent review signs off; and the bounded gate is explicitly reopened.
This page defines what each identity can do, where its key lives, how it rotates, what is on-chain, and which parts exist today. “Node wallet” is not one universal key.
payTo, and persistent CYNDER_NODE_ID exist. A cryptographic node manifest, node-held evidence/anchor signers, formal treasury/refund custody, and a Cynder-authored anchor contract do not yet exist.| Role | Truth state | Custody | Authority | Must not |
|---|---|---|---|---|
| CUSTOMER_ACTION_SIGNER | IMPLEMENTED · EOA ONLY | customer/agent outside cynderd | EIP-191 action authorization and EIP-3009 payment authorization; signer must equal payer | administer node, sign evidence/anchors, receive node treasury authority |
| LOGICAL_NODE_ID | IMPLEMENTED LABEL · CRYPTOGRAPHIC BINDING TARGET | persisted in canonical Badger and independently pinned genesis manifest digest | stable attribution across pod/host/key rotations | be treated as a private key, wallet address, hostname, pod UID, or IPFS peer ID |
| EVIDENCE_SIGNER | TARGET · REQUIRED FOR SIGNED EVIDENCE | non-exportable Ed25519 signer preferred; isolated read-only key fallback | sign deterministic evidence envelopes only | hold funds, sign EVM transactions, administer contracts, or own customer actions |
| ANCHOR_SIGNER | TARGET · OPTIONAL BASE LAYER | isolated low-balance secp256k1 signer with policy/allowlist | submit exact finalized evidence commitments to one allowlisted contract | be payee, treasury, customer, evidence, or admin key |
| X402_PAYEE_TREASURY_REFUND | CONFIGURED ADDRESS · CUSTODY TARGET | external Base Safe 2-of-3; no owner key in cynderd | receive Base USDC and execute treasury/refund movements under one explicit dual-approval Safe policy | sign customer actions, routine evidence, anchor transactions, or node/contract administration |
| NODE_ADMIN_CONTRACT_ADMIN | TARGET | offline/operator Base Safe 2-of-3; digest pinned independently | approve identity manifests, payee/signer changes, node replacement, contract node registration/rotation | be mounted in the pod or sign routine evidence/anchors |
| EMERGENCY_PAUSER | TARGET · OPTIONAL CONTRACT | separately held hardware-backed operations key or dedicated Safe role | pause anchor submission only | unpause, rotate signers, move treasury, or rewrite accepted anchors |
CYNDER_NODE_ID remains an opaque stable 1–63 character identifier bound to one canonical Badger lineage; it is not a wallet or public-key fingerprint.
Schema: cynder-node-identity/v1
Canonicalization: RFC 8785 JCS; SHA-256 over the canonical manifest excluding admin_signatures; domain CYNDER_NODE_IDENTITY_V1\0
Contract node ID: nodeId = SHA-256(ASCII('CYNDER_NODE_ID_V1') || 0x00 || uint8(len(node_id)) || ASCII(node_id)); node_id must first pass the existing lowercase ASCII 1–63 character validator. The exact 32 bytes, not a hex string, enter AnchorInput and contract storage.
Genesis: The empty store accepts genesis only when its digest equals an independently configured CYNDER_NODE_GENESIS_DIGEST; writable Badger is not trust-on-first-use authority.
Epoch: Changes only for an offline-authorized node replacement or declared continuity break; routine signer/payee rotation increments manifest_sequence, not identity_epoch.
CYNDER_NODE_ID CYNDER_NODE_GENESIS_DIGEST CYNDER_NODE_IDENTITY_MANIFEST_FILE CYNDER_EVIDENCE_SIGNER_URI CYNDER_ANCHOR_SIGNER_URI # optional CYNDER_X402_PAY_TO
| Role | Algorithm | Online | Funds | Preferred interface | Rotation |
|---|---|---|---|---|---|
| evidence signer | Ed25519 | yes | none | non-exportable signer URI/KMS/HSM | overlap plus dual-signed transition when available |
| anchor signer | secp256k1 | only when Base anchoring enabled | bounded ETH gas only; no USDC | policy-controlled signer URI allowing exact chain/contract/function | contract propose + delayed accept + test anchor + revoke old |
| x402 payee/treasury/refund | Safe owner policy | outside cynderd | USDC revenue | Base Safe 2-of-3 | signed manifest effective time plus bounded old-payee settlement overlap |
| node/contract admin | Safe owner policy | no | minimal admin gas | separate Base Safe 2-of-3 | old threshold approves new policy; both policies validate transition |
| emergency pauser | secp256k1 | incident use only | bounded gas | separate hardware-backed key | admin-only setPauser to a nonzero replacement |
Network: eip155:8453
Address: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Authority: Circle deployment/proxy; Cynder verifies exact network, proxy/implementation or code identity, EIP-3009 authorization state/events, Transfer event, and transaction receipt
Use: x402 settlement
Not: not node identity, evidence anchoring, escrow, staking, or governance
Network: Base Sepolia before Base mainnet
Address: unset until a verified immutable deployment manifest exists
Authority: node-scoped anchor signer; admin Safe manages node registration/rotation; separate pauser can only pause
Use: append-only root/CID commitments
Not: no x402 settlement, evidence storage, truth attestation, action execution, consensus, treasury, escrow, token, staking, or governance
immutable non-proxy V1; new contract address and signed migration manifest for incompatible changes
exact Solidity compiler, optimizer settings, EVM target, source revision, ABI digest, deployment transaction/block, runtime code hash, constructor args, chain ID, and source verification recorded in a signed deployment manifest
keccak256(abi.encode(keccak256('CYNDER_EVIDENCE_ANCHOR_V1'), block.chainid, address(this), all AnchorInput fields))
Decoded canonical CID bytes are committed as keccak256(cidBytes); the contract does not parse or store raw CIDs.
nodeId | bytes32 |
identityEpoch | uint64 |
blockSequence | uint64 |
previousAnchor | bytes32 |
identityManifestDigest | bytes32 |
evidenceEnvelopeDigest | bytes32 |
contentCommitment | bytes32 keccak256 of decoded canonical CID bytes |
merkleRoot | bytes32 |
schemaVersion | uint32 |
latestAnchor | bytes32 |
latestSequence | uint64 |
identityEpoch | uint64 |
signer | address |
active | bool |
signer | address |
validAfter | uint64 unix seconds |
empty | signer=address(0) and validAfter=0; proposal overwrite is forbidden until accepted or admin-cancelled; acceptance/cancellation clears both fields atomically |
admin | address |
pendingAdmin | address |
pendingAdminValidAfter | uint64 |
pauser | address |
paused | bool |
Constructor: constructor(address initialAdmin, address initialPauser, uint64 signerRotationDelay, uint64 adminRotationDelay); all addresses nonzero; delays immutable; deployer receives no implicit authority unless explicitly supplied as initialAdmin.
submitAnchor | only the active node signer for input.nodeId |
registerNode | onlyAdmin |
setNodeActive | onlyAdmin |
proposeNodeSigner | onlyAdmin |
acceptNodeSigner | only the pending signer after signerRotationDelay |
cancelNodeSignerProposal | onlyAdmin |
advanceNodeEpoch | onlyAdmin while node inactive; new epoch=current+1 and expectedHead=current latestAnchor |
setPauser | onlyAdmin; nonzero replacement |
proposeAdmin | onlyAdmin; nonzero pending admin and adminRotationDelay |
acceptAdmin | only pending admin after delay |
pause | pauser or admin |
unpause | onlyAdmin |
submitAnchor(AnchorInput) returns (bytes32 anchorId) computeAnchorId(AnchorInput) view returns (bytes32) getNodeState(bytes32) view returns (NodeState) isAnchored(bytes32) view returns (bool) registerNode(bytes32 nodeId,address initialSigner,uint64 initialEpoch) setNodeActive(bytes32 nodeId,bool active) proposeNodeSigner(bytes32 nodeId,address newSigner) acceptNodeSigner(bytes32 nodeId) cancelNodeSignerProposal(bytes32 nodeId) advanceNodeEpoch(bytes32 nodeId,uint64 newEpoch,bytes32 expectedHead) setPauser(address newPauser) proposeAdmin(address newAdmin) acceptAdmin() pause() unpause()
Rotation: admin proposes nonzero signer; delay elapses; proposed signer proves possession by accepting; sequence/head never reset; compromised node is disabled before rotation
Pause: blocks submitAnchor only; reads/history/admin recovery remain available; IPFS evidence continues and ordered backlog accumulates
Signing: anchor signer signs only exact chain, runtime-code-hash-pinned contract, submitAnchor selector, finalized local payload, bounded gas/fee/day; one transaction in flight per node
States: LOCAL_COMPLETESUBMISSION_PENDINGL2_INCLUDEDANCHOR_CONFIRMEDANCHOR_FINALREORGEDFAILED_RETRYABLEHALTED_CONFLICT
Reorg: rebroadcast identical immutable payload if receipt disappears and head reverted; preserve all attempt hashes; halt if canonical contract head conflicts
target operator workflow: original payer and settled receipt determine destination/maximum amount; treasury Safe dual approval; stable refund intent ID; preflight and post-chain reconciliation prevent duplicate refund; no unrestricted refund key in cynderd
Future keys are new roles with independent custody and are never aliases or derivations of one-node keys.
P2P_TRANSPORTP2P_NODE_ASSERTIONVALIDATOR_CONSENSUSEXECUTOR_ATTESTATIONARTIFACT_PROVIDERExact revision lineage, source custody, economic invariants, and the boundary to future architecture.
{
"roadmapParent": {
"kind": "roadmap_parent",
"revisionId": "rev_cynder_delivery_roadmap_one_node_ipfs_foundation_v1_5_0_20260905",
"indexSha256": "e4ac596ab514ae0c7345770c6bac26724869e225ab598d9c5fd31405842153ad",
"workbookSha256": "dfbd8b953b7124703083381e327e46eb36e9edddcd11db71ec2ed2856076291f"
},
"whitepaper": {
"kind": "whitepaper",
"revisionId": "rev_cynder_whitepaper_target_architecture_v0_5_3_20260905",
"sha256": "7188aa3fc17c35e20f1d66b1e4d58ece248a380b6e9e652a2b8e5cd4ec5cfb43"
},
"implementationBaseline": {
"repository": "https://github.com/berryhill/cynder.git",
"sourceRoot": "/home/silas/.hermes/workspace/codebases/cynder",
"gitCommit": "134072ad266736c796ab7eac03679724a0af3a0f",
"gitTree": "c16e1769e35a2c50c60487d428c7a8a31f86cede",
"identityMethod": "Git commit and tree object IDs; exact source is retrievable from the repository",
"workspaceObservation": "The canonical clone had uncommitted explorer/statistics work during roadmap assurance; those mutable bytes are not part of the pinned implementation baseline."
}
}| Customer wallet | External Base EOA signing its own Cynder action and x402 authorization. |
| Node ID | Stable non-secret logical identity; not a wallet or key. |
| Payee/treasury | External Safe receiving USDC and authorizing treasury/refund movements. |
| Evidence signer | Online no-funds Ed25519 key signing evidence envelopes only. |
| Anchor signer | Optional low-balance EVM signer submitting one exact contract method. |
| Admin | Offline/operator Safe authorizing manifests, registrations and rotations. |
| Pauser | Separate authority able only to stop new anchors. |
| Facilitator | External x402 verifier/submitter; not node identity, custody, or final chain truth. |
eip155:8453 · 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Required external EIP-3009 settlement dependency. Exact proxy/implementation or runtime-code identity must be verified by the release manifest.
No address exists. Target is immutable/non-proxy and optional. A signed deployment manifest must name chain, address, transaction, block, runtime code hash, ABI digest, compiler/settings, admin, pauser, signer and finality policy.
CAIP-10EIP-191EIP-712EIP-3009RFC 8785 JCSEd25519ERC-1271: unsupported currentSafe: target custodyIPFS CID/multihash
M7 and G-IPFS make deterministic evidence blocks, IPFS publication, redundant retrieval, and independent verification required before one-node release rehearsal. Badger remains canonical and IPFS remains asynchronous to customer execution.
Base root/CID anchoring is a separate optional gate. CometBFT, validators, provider markets, token, staking, liquidity, and governance remain future/conditional and outside required M0–M10 scope.